Privacy Policy

Ledger is a private expense tracker built for two people sharing one household — a couple or roommates who want a single, shared view of their money. This policy explains what data Ledger collects, how it is used, where it is stored, and how you can have it deleted.

What data we collect

• Bank SMS text. With your permission, the app reads incoming SMS that look financial (contain a currency amount and transaction-like wording) and forwards that text to our server so it can be parsed into a transaction. SMS from senders or messages that don't look financial are never forwarded.
• Transaction data. Amounts, merchants, categories, dates, and notes for every transaction you or your partner add — manually or via SMS.
• Wallet and budget data. Account/wallet names, balances, and the budgets you set per category.
• Household membership. Which two accounts belong to a household, so data can be shared between partners.
• Device identifiers. A Firebase Cloud Messaging (FCM) token, used only to deliver push notifications (e.g. a transaction suggestion, a budget alert).
• Account details. Your name, mobile number, and password (stored as a salted hash, never in plain text).

How we use this data

• To automatically categorize and record transactions from bank SMS, so you don't have to enter them by hand.
• To keep wallet balances and net worth accurate and in sync between both partners in a household.
• To send push notifications for transaction suggestions, budget thresholds, and account activity relevant to your household.
• To improve categorization accuracy over time based on corrections you make (this learning happens within your own household's data — it is never shared across households).

Where data is stored

Application data is stored on MongoDB Atlas (a managed cloud database). The backend runs on AWS Lambda. Push notifications are delivered through Firebase Cloud Messaging (FCM). We do not sell your data, and we do not share it with advertisers or other third parties. These providers process data only as needed to operate the app (hosting and message delivery) and do not have independent rights to use it.

Data retention

• Raw SMS text is purged automatically after approximately 30 days, or as soon as it has been resolved into a transaction (or dismissed), whichever is sooner. We do not keep an indefinite archive of your text messages.
• Transaction, wallet, budget, and household data is retained for as long as your household exists, so you retain full transaction history.

Your rights

You can request deletion of your household and all associated data — transactions, wallets, budgets, and account details — at any time by contacting us at the email below. We will confirm and complete the deletion promptly.

Account & data deletion

What gets deleted

When you request deletion, all household-scoped data is permanently and irreversibly removed:

• users — account credentials, profile (name, accent colour, FCM tokens, PIN hash)
• households — household record and invite codes
• wallets — all bank accounts, credit cards, cash, and pay-later wallets
• categories — all custom categories
• transactions — every transaction (manual and SMS-auto)
• recurring_rules — all recurring transaction templates
• budgets — all budget limits
• loans — all loan records
• notifications — all push notification history
• sms_inbox — all raw SMS text and parsed suggestions
• sms_parser_rules — household-specific parser rules
• merchant_category_map — learned category mappings
• merchant_wallet_map — learned wallet mappings
• merchant_aliases — household-specific merchant aliases
• category_keyword_rules — household keyword rules
• net_worth_snapshots — historical net worth snapshots
• revoked_tokens — any revoked refresh tokens for the user

What is not deleted

• Anonymised, aggregated analytics — never linked to any deleted account.
• No third-party data is shared (per this privacy policy).

Retention period

Deleted data is purged within 30 days of a confirmed request. Raw SMS text is already auto-purged after approximately 30 days regardless of deletion requests.

Children's privacy

Ledger is not directed at children and is not intended for use by anyone under 18.

Changes to this policy

If this policy changes, we'll update the "last updated" date above. Continued use of the app after a change means you accept the updated policy.

Contact

For privacy questions, data deletion requests, or anything else, email founder@journeymen.in.